vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

swarm-ui: swap colors.css via a plain nginx location, not a package-copy derivation

Browse source 
mara, on review: "i thought we just swap a css file via nginx
config?" -- right instinct. The package-copy overlay (cp -r + install)
only made sense for hive-c0re's servedFrontend, which backs multiple
serve points (dashboard root + every per-agent gateway route) from one
swapped tree. swarm-ui has exactly one location serving cfg.package, so
an = /static/colors.css exact-match override -- the same idiom every
other single-path override on this vhost already uses (/api/whoami,
/api/docs) -- replaces the whole derivation with one location block.

Verified with the same throwaway nixosSystem eval as the previous
commit: unthemed case has no colors.css location and the / root is
cfg.package unchanged.
This commit is contained in:
iris 2026-08-24 12:58:15 +02:00 • committed by mara
commit 10a294a2f8
1 changed files with 31 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

45
nix/host-modules/swarm-ui.nix
View file

@ -22,21 +22,21 @@ let
# this UI was left out of that overlay entirely (an operator with a
# stylix-themed host saw the dashboard in their own colours but this
# UI still on the default Catppuccin palette), because nothing here
# ever wrote a themed `colors.css` over `cfg.package` before serving
# it; the c0re-side overlay only ever touched `dashboard/`/`agent/`.
# Detection + CSS-generation is shared (`./stylix-theme.nix`);
# `servedPackage` is this module's own overlay-onto-`cfg.package`
# consumer, same shape as `theme.nix`'s `themedFrontend`.
# ever served a themed `colors.css` in place of `cfg.package`'s own.
# Detection + CSS-generation is shared (`./stylix-theme.nix`).
#
# No package-copy derivation: this vhost has exactly one location
# serving `cfg.package` (unlike hive-c0re's `servedFrontend`, which
# backs both the dashboard root AND every per-agent gateway route, so
# a single swapped tree covers both) — an `= /static/colors.css`
# exact-match location overriding just that one file, same idiom
# every other single-path override on this vhost already uses
# (`/api/whoami`, `/api/docs`), is simpler than copying the whole
# static tree to change one file inside it. mara, on review: "i
# thought we just swap a css file via nginx config?" — yes, and this
# is that.
stylixTheme = import ./stylix-theme.nix { inherit lib config pkgs; };
inherit (stylixTheme) stylixThemeColors themedColorsCss;
themedPackage =
c:
pkgs.runCommand "hyperhive-swarm-ui-themed" { } ''
cp -r ${cfg.package} $out
chmod -R u+w $out
install -m644 ${themedColorsCss c} $out/static/colors.css
'';
servedPackage = if stylixThemeColors != null then themedPackage stylixThemeColors else cfg.package;
# Repeated verbatim by every location that should be operator-gated
# (`/`, `/api/`, `/api/docs/`) rather than set once on the server:
@ -191,7 +191,7 @@ in
extraConfig = gatewayCfg.lib.securityHeaders;
locations = {
"/" = {
root = "${servedPackage}";
root = "${cfg.package}";
extraConfig = ''
${swarmAuthRequest}
# SPA: any path the bundle routes client-side is served the
@ -199,6 +199,23 @@ in
try_files $uri /index.html;
'';
};
}
// lib.optionalAttrs (stylixThemeColors != null) {
# Stylix theming (see the `let` block above): overrides just
# this one file from `cfg.package`'s own static root, rather
# than copying the whole tree to change one file inside it —
# nginx resolves the more specific `=` exact match over the
# `/` prefix root above, so this simply doesn't exist (falling
# through to the package's own untouched colors.css) when
# there's no active palette. Same `auth_request` gate as every
# other location here — no reason for this one path to have a
# different failure mode than the page that loads it.
"= /static/colors.css" = {
alias = "${themedColorsCss stylixThemeColors}";
extraConfig = swarmAuthRequest;
};
}
// {
# swarm-controller's whole HTTP surface, including the live
# `/api/openapi.json` spec — proxied untouched (no URI segment
# after the socket path, same "pass the request through as-is"